CVE Vulnerability Catalog

A race condition exists in the Linux kernel device-mapper subsystem when loading and unloading a table concurrently. dm_setup_md_queue walks &md->table_devices without any lock, so racing with dm_table_destroy can lead to access to invalid memory.

A race condition exists in the Linux kernel device-mapper subsystem between resume and remove ioctls. If a user issues resume and remove at the same time, the device may be resumed after being suspended in __dm_destroy, so the table is destroyed without calling the postsuspend method, breaking dm target expectations and potentially causing use-after-free (e.g. in dm-integrity).

In the Linux kernel dma-heap interface (DMA_HEAP_IOCTL_ALLOC), the dma-buf file descriptor was published into the caller's fd table before the result was copied back to userspace. If the trailing copy_to_user() failed, the fd remained visible to other threads and leaked for the lifetime of the process. The fix restructures the allocation path so that fd installation is the last, unfailable step.

In the Linux kernel, dma_direct_alloc_from_pool() returns a CPU address instead of a struct page *, which does not match the expectations of dma_direct_alloc_pages(). The bug was introduced by commit 5b138c534fda and can lead to incorrect behavior or a crash.

In the Linux kernel, the fsl-edma dmaengine driver tracing events store a pointer to struct fsl_edma_engine and dereference it when printing a log entry, at which point the pointer may no longer be valid. Event injection (e.g. via the inject file) can trigger a kernel crash.

In the Linux kernel, the dw-edma dmaengine driver passes struct dw_edma_irq to request_irq() before dw_edma_channel_setup() fills the back pointer. A shared interrupt can therefore enter the handler with dw_irq->dw still NULL, causing a NULL pointer dereference.

In the Linux kernel, dt_idle_pd_alloc() allocates memory for the full node path and then sets pd->name to point to the basename of that string. dt_idle_pd_free() frees pd->name, which no longer points to the start of the allocation, leading to an invalid free.

A bug was fixed in the Linux kernel's BPF pcpu_freelist mechanism that caused an infinite loop in __pcpu_freelist_push(). The issue occurs when only one CPU is possible (e.g. CONFIG_SMP=n, nr_cpus=1 or possible_cpus=1) and an NMI re-enters pcpu_freelist_push() while the interrupted context holds that CPU's freelist lock. The fallback loop then has no other possible CPU to examine and can never acquire the lock.

In the Linux kernel, ceph_mds_check_access() traverses the s_cap_auths array without holding the mutex. A concurrent MDS session reopen can free this array while it is being inspected, resulting in a use-after-free.

In the Linux kernel, validate_hash_algo() passes the result of dentry_path() directly to integrity_audit_msg() without checking for ERR_PTR. When the path exceeds the buffer, dentry_path() returns ERR_PTR(-ENAMETOOLONG), leading to a strlen() call on an invalid pointer and a page fault.

In the Linux kernel, __within_kprobe_blacklist() traverses the kprobe_blacklist without holding kprobe_mutex. When a module is unloaded, entries are immediately freed, leading to a use-after-free in a concurrent call to within_kprobe_blacklist().

A vulnerability in the Linux kernel's handling of huge pages for tmpfs was found. During unmapping (zap), the dirty bit from the PMD entry is not transferred to the folio, leading to loss of write information. As a result, data in MAP_SHARED tmpfs segments can be silently lost during unmap if the page is PMD-mapped and swap is enabled.

In the Linux kernel, alloc_pages_bulk_weighted_interleave() hardcodes GFP_KERNEL when allocating the temporary weights array, even when called in atomic/RCU context. This can trigger a might_alloc() splat due to a sleeping allocation in an invalid context.

In the Linux kernel, memcg_reparent_objcgs() assumes that a folio's objcg matches its node. Folio migration across nodes breaks this assumption, leading to inconsistency and potential use of the wrong LRU lock, which can cause data corruption or crashes.

A vulnerability in the Linux kernel's perf/x86/intel subsystem allows kernel address leakage to user space. The intel_pmu_lbr_filter() function did not fully validate the privilege level of sampled entries, so the LBR stack could contain kernel addresses even when PERF_SAMPLE_BRANCH_USER was requested. The fix extends software filtering to validate both from and to addresses against br_sel.

In the Linux kernel, i2c_del_adapter() frees the adapter's debugfs directory before unregistering the device, but the new_device sysfs attribute remains writable. A race between a write and removal can lead to a use-after-free in i2c_device_probe().

In the Linux kernel, the i2c mux subsystem has a reference leak of the Device Tree channel node when adapter registration fails. i2c_mux_add_adapter() takes a reference before registering, but on error it does not release it, causing a memory leak.

In the Linux kernel for arm64, there is an issue with reading the GMID_EL1 register when MTE is disabled. The read is performed even when MTE is off, leading to an Undefined instruction error and kernel panic in pKVM environments.

In the Linux kernel, the ALSA harmony driver has an issue with lock initialization before IRQ registration. The IRQ is registered before h->lock and h->mixer_lock are initialized, which can lead to the interrupt handler using uninitialized locks.

A race condition exists in the Linux kernel between non-atomic ALSA PCM operations (hw_params, hw_free, prepare) and the atomic trigger-start operation. While one thread performs a non-atomic operation, another thread can trigger the PCM start, leading to state inconsistencies and ODEBUG warnings reported by syzkaller. The fix prevents trigger-start during non-atomic operations by checking the runtime->buffer_accessing value.